Separate Windows hardware signing from timestamp completion
分离 Windows 硬件签名与时间戳处理
A combined SignTool command reports timestamp failure as signing failure. Retrying it repeats hardware access, while treating every timestamp error as an uncertain private-key outcome requires administrator recovery. Public timestamp-only requests can fail independently of the token.
Source compatibility: Chinese title uses a compatible non-canonical header
English
Problem
A combined SignTool command reports timestamp failure as signing failure. Retrying it repeats hardware access, while treating every timestamp error as an uncertain private-key outcome requires administrator recovery. Public timestamp-only requests can fail independently of the token.
Decision
Sign a private PE copy once without a timestamp. Release the hardware interlock only after successful execution and Windows verification of the configured primary signature. Hardware or primary-verification failures retain the interlock; no path automatically recovers it. Appended signatures are unsupported.
Timestamp fresh copies of the frozen signed file without signing credentials. Only normal failure or warning exits permit another attempt: at most three calls, with one- and two-second delays. Launch failures, uncertain termination, storage changes and verification failures stop immediately. The preflight's overall 60-second deadline includes these operations and does not guarantee three full subprocess deadlines.
Require Windows trust, timestamp and certificate identity. Remove unsigned signature attributes from private copies with the configured SignTool and compare their complete normalized bytes. A removal warning is accepted only when all bytes remain unchanged. Certificate equality alone cannot exclude different content signed by the same certificate; full-file equality avoids a custom PE or ASN.1 canonicalizer.
SignTool uses short filenames with the original extension in a private temporary directory. Its longest generated path is checked before hardware access, and the journal records the original-to-staged mapping. The target may occupy another volume: copy verified bytes into a private directory beside it, compare hashes, recheck the original and rename within that volume. Verify committed bytes afterward. The build account must own trusted storage and exclusive target access.
Exhausted timestamp attempts stop packaging and queued work without another hardware call. Failure evidence is copied to the supervised run before staging cleanup; evidence or audit failure preserves staging. Final artifact verification and release completion remain mandatory. The primary-runtime decision owns runtime contents and vendor signatures.
Alternatives considered
Retry combined signing or classify diagnostic text. Exit codes and localized text cannot establish the private-key outcome. Separate operations avoid repeated hardware access.
Reuse failed timestamp output. A failed process may partially modify its file. Every attempt starts with identical verified primary-signature bytes.
Stage beside each target for all operations. Nested dependencies can exceed SignTool's path limit even when the original fits. Short tool paths and same-volume publication address separate requirements.
Consequences
Fault tests cover lock retention, isolated timestamp retries, queue rejection, credential exclusion, substituted content, changed targets, long paths and evidence failures. Public-only qualification covers EXE, DLL, PYD and NODE files, including failure followed by success and cross-volume publication. A real supervised signing preflight has passed; complete installer comparisons remain separate qualification. This decision does not identify or repair the timestamp service's network failures.
DigiCert supports separate signing and timestamping. Microsoft documents SignTool commands and exit codes. The configured tool and normalization implementation participate in signature-cache identity.
中文
问题
合并的 SignTool 命令把时间戳失败报告为签名失败。重试会重复访问硬件，而把所有时间戳错误都视为私钥操作结果不确定，又需要管理员恢复。公开时间戳请求可以在不使用令牌的情况下独立失败。
决策
对私有 PE 副本仅签名一次，不请求时间戳。只有命令成功且 Windows 验证配置证书的主签名后，才释放硬件互锁。硬件或主签名验证失败保留互锁；任何路径都不自动恢复互锁。不支持追加签名。
从固定的已签名文件生成新副本并请求时间戳，不传递签名凭据。只有正常退出但返回失败或警告时才允许再次尝试：最多调用三次，间隔为一秒和两秒。启动失败、终止状态不确定、存储变化和验签失败会立即停止。预检整体 60 秒期限包含这些操作，不保证每次子进程都能获得完整期限。
要求 Windows 信任、时间戳和证书身份均通过验证。使用配置的 SignTool 删除私有副本的未签名属性，再比较完整的规范化字节。删除警告仅在所有字节未变时接受。仅比较证书无法排除由同一证书签署的不同内容；全文件相等检查避免自行实现 PE 或 ASN.1 规范化器。
SignTool 在私有临时目录中使用保留原扩展名的短文件名。访问硬件前检查生成的最长路径，日志记录原文件与暂存文件的对应关系。目标可以位于另一个卷：将已验证字节复制到目标旁的私有目录，比较摘要，重新检查原文件，再在同一卷内重命名。随后验证提交后的字节。构建账户必须拥有受信任的存储和目标独占访问权。
时间戳尝试耗尽后，停止打包和排队任务，不再次调用硬件。清理暂存目录前，将失败证据复制到受监督运行目录；证据保存或审计失败时保留暂存目录。最终产物验签和发布完成检查仍是必需步骤。第一方运行时决策负责运行时内容与上游签名。
考虑过的替代方案
重试合并签名命令或按诊断文本分类。 退出码和本地化文本无法确定私钥操作结果。分离操作避免重复访问硬件。
复用失败的时间戳输出。 失败进程可能已部分修改文件。每次尝试均从相同的已验证主签名字节开始。
所有操作都在目标旁暂存。 即使原路径未超限，嵌套依赖的暂存路径也可能超出 SignTool 限制。短工具路径和同卷发布分别满足不同要求。
影响
故障测试覆盖互锁保留、独立时间戳重试、队列拒绝、凭据隔离、内容替换、目标变化、长路径和证据保存失败。仅使用公开操作的验收覆盖 EXE、DLL、PYD 和 NODE 文件，包括先失败后成功及跨卷发布。真实受监督签名预检已通过；完整安装包对比仍需单独验收。此决策不确定或修复时间戳服务的网络故障。
DigiCert 支持分开签名与添加时间戳。Microsoft 记录了 SignTool 命令及退出码。配置的工具和规范化实现均参与签名缓存身份计算。